50 Offline & desktop-sync data minimization

Offline Docs, offline Gmail and Drive for desktop each mirror tenant data onto the local disk, where a lost, stolen or seized laptop yields it with no Workspace authentication in the way. This control turns those caches off, or restricts Drive for desktop to authorized devices — listed in the company-owned device inventory with a matching serial number — so the data stays server-side where the access controls actually are.

Caveats

Turning offline access off does not purge caches that already exist¹
The local copy only stays gone if users cannot simply re-enable it²
‘Authorized devices’ depends on the device being in the company-owned inventory with a matching serial number³
Real usability cost⁴
The device-policy variant is available on every edition, but requires installing the managed device…⁵

Setup steps

open ↗
https://admin.google.com/ac/managedsettings/55656082996 · captured 2026-07-15
Apps › Google Workspace › Drive and Docs › Features and Applications
Restrict browser offline access so a stolen or unmanaged machine has no local Docs/Sheets/Slides cache to harvest.

Offline access
Use policies to control offline access from computers (not 'Allow users to turn on offline access')

Set up offline access to Docs, Sheets & Slides ↗
Apps › Google Workspace › Drive and Docs › Features and Applications › Google Drive for desktop
Either disable Drive for desktop for the OU (organizational unit), or allow it only on authorized devices (in the company-owned device inventory with a matching serial number).

Allow Google Drive for desktop in your organization = off for high-risk OU; otherwise 'Only allow Google Drive for desktop on authorized devices' = checked

Set up Drive for desktop for your organization ↗ Use Drive for desktop with Google endpoint management ↗
open ↗
https://admin.google.com/ac/apps/gmail/enduseraccess · captured 2026-07-15
Apps › Google Workspace › Gmail › User settings
Turn off offline Gmail so the mailbox is not mirrored into browser local storage.

Enable Gmail web offline = unchecked for the OU; optionally check 'Force deletion of offline data on log out of Google account'

Use Gmail offline with Google Workspace ↗

How to verify

On a covered machine, confirm Drive offline availability and desktop-sync are refused for the restricted OU (the Drive settings toggle should be absent/greyed for a test user).

v0.0.3Prevent policy #25 · #15, #7 ↗